CVE-2012-6661
Medium
Description
Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
SeverityMedium
CVSS5.0
Exploit probability—
Product
Plone
PublishedNov 3, 2014
First seenNov 3, 2014
How to fix
Update
- zope22.13.19 or later
- plone4.2.3, 4.3b1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plone plone | v ≤ 4.2.2, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.5, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5.1, 3.1.6, 3.1.7, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6.1, 4.1, 4.1.4, 4.1.5, 4.1.6, 4.2, 4.2.1, 4.3 | — |
| zope zope | v ≤ 2.13.18 | — |
| zope2PyPI | v < 2.13.19 | 2.13.19 |
| plonePyPI | 3.2.2 ≤ v < 4.2.3, 4.3a1 ≤ v < 4.3b1, v < 4.2.3, 4.3a0 ≤ v < 4.3b1 | 4.2.3, 4.3b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.